Privacy Policy

Alice Care ("we," "our," or "us") is committed to protecting your privacy and the confidentiality of your health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application, our clinical web portal, and the alicecare.health website (collectively, the "Service").

1. Information We Collect

1.1 Personal Information

We collect information you provide directly to us, including:

• Account Information: Name, email address, phone number, preferred language, and role (parent, caregiver, healthcare provider, clinic administrator)
• Profile Information: Profile photos, notification and reminder preferences
• Authentication Data: Login credentials, two-factor authentication secrets and backup codes (encrypted at rest), and trusted-browser records
• Support Requests: The message you write when you contact support, plus any screenshot you choose to attach

1.2 Protected Health Information (PHI)

As a healthcare application, we collect and process PHI in accordance with HIPAA regulations, including:

• Patient Demographics: Name, date of birth, allergens being treated
• Treatment Data: Dosing schedules, dose logs, treatment protocols, protocol levels and dose adjustments
• Medical Information: Reaction logs, symptoms, severity assessments, and optional reaction photographs
• Clinical Notes and Care Plans: Healthcare provider observations, goals, interventions, and versioned care plans
• Appointment Records: Scheduled visits, updose appointments, sample-preparation records
• Care-Management Records: Time and activity your care team logs for care-management programs (see Section 3.6)

1.3 Care-Team Messages

The Service includes secure two-way messaging between families and their care team. We collect and store:

• The text of messages sent in a care conversation
• Files and photographs attached to a message. Attachments are write-once and form part of the message record.
• Short voice recordings you make with the microphone button. Audio is transcribed to text (Section 2.5) so you can edit it before sending; nothing is sent to your care team automatically.
• Read receipts, delivery status, and the record of who accessed the conversation

Care-team messages are Protected Health Information and are handled under the safeguards in Section 4.

1.4 Automatically Collected Information

• Device Information: Device type, operating system, application version
• Usage Data: Which features and screens are used, and how long a session lasts, in the de-identified form described in Section 3.3
• Log Data: IP address, access times, and error diagnostics, retained in Google Cloud for security monitoring and troubleshooting
• Audit Records: A tamper-evident log of access to and changes made to health information, as HIPAA requires

The Service does not request or collect your device's precise location. Where the app shows a map of clinics, it is driven by the country you select, not by device GPS.

1.5 Community Content

When you post in the Community feature, we collect and store:

• The text of your posts and comments
• Optional metadata you select (treatment phase, allergen, post type)
• Whether you chose to post anonymously
• Reactions, likes, and replies
• Moderation flags raised by automated systems or other users, and associated review actions

Community content is hosted by Stream / GetStream on our behalf and is screened by an automated moderation service before publication (see Section 3.3). The Community is available only to self-managed ("standalone") accounts that are not connected to a clinic, and community content is never mixed with clinical records. Posts you make may be visible to other users of the Service. Do not share Protected Health Information or personally identifying details (yours or anyone else's) in community posts.

1.6 Website Visitors

The public alicecare.health marketing website uses conventional web analytics (Google Analytics 4 with IP anonymization, Microsoft Clarity, and first-party page-performance measurement) to understand how the site is found and used. These tools run on the marketing website only. They are not present in the mobile application or in the signed-in clinical portal, and they never receive health information. In the EU, UK, EEA, and Switzerland, advertising and analytics storage are denied by default until you consent.

2. How We Use Your Information

We use the collected information for the following purposes:

• Treatment Management: Enable tracking of OIT doses, reactions, and treatment progress
• Care Coordination: Facilitate secure messaging and care planning between patients, caregivers, and healthcare providers
• Clinical Alerts: Notify healthcare providers of concerning reactions or missed doses
• Appointment Management: Schedule and manage clinic visits and updose appointments
• Billing and Care-Management Programs: Support clinic documentation and billing for care-management services you have consented to (see Section 3.6)
• Service Improvement: Analyze de-identified usage patterns to improve the application
• Security: Detect and prevent unauthorized access or fraudulent activity
• Legal Compliance: Meet regulatory requirements and respond to legal requests
• AI-Assisted Features: Process a limited subset of treatment data through Google Cloud Vertex AI to power the features listed in Section 2.5 — family-facing features only with your explicit consent; clinician tools as part of your care team's treatment of your child

2.5 AI Processing

All AI-assisted features in the Service run on Google Cloud Vertex AI, inside the same Google Cloud environment and the same signed HIPAA Business Associate Agreement that hosts the rest of your data. Requests are authenticated with the service identity of our backend — no data is sent to a third-party AI gateway, no consumer AI endpoint is used, and no API keys are shared with any outside provider. Inference is pinned to United States regions.

The AI-assisted features are:

• Ask Alice (families). Answers questions about your child's treatment. Each request sends your typed question and recent conversation context, the child's first name, age, allergens, current dose, treatment phase, and protocol level.
• Treatment updates and progress summaries (families). Sends the child's first name, allergens, current dose, treatment phase, protocol level, aggregated adherence metrics (missed-dose count, streak, average dose time), recent reaction summaries, and recent dose-adjustment history.
• Clinical summaries (clinicians). Summarizes a patient's chart or an upcoming appointment for the treating care team, from a fixed allowlist of clinical fields.
• Reply drafting (clinicians). Proposes a draft reply to a family's message. The clinician always reviews and edits before anything is sent.
• Care-plan drafting (clinicians). Proposes care-plan goals and interventions from the patient's treatment record for the clinician to review, edit, and approve.
• Message translation. Translates a care-team message between the languages the Service supports.
• Voice dictation. Converts a short recording into editable text in the message composer.

What is never sent: last names, dates of birth, home addresses, phone numbers, email addresses, account identifiers, or payment information.

Model training and retention: Under Google Cloud's Vertex AI terms, your prompts and responses are not used to train Google's models and are not retained by Google for that purpose. Processing occurs only to fulfill the request you made.

Your control: The family-facing AI features (Ask Alice, treatment updates, and the translation and dictation tools you use yourself) are off by default. They require explicit opt-in consent before any data is sent, and that consent is enforced on our servers rather than only in the app. You can revoke it at any time in Settings → Privacy & Security → AI & Data Sharing; your family's future AI requests are then blocked until you re-consent.

Clinician tools: The clinician-facing features above (clinical summaries, reply drafting, care-plan drafting, and the translation and dictation tools clinicians use in their own work) are part of how your care team treats your child, under our agreement with your clinic and the same HIPAA Business Associate Agreement, minimized data allowlists, and United-States-pinned processing described in this section. They operate independently of the family-facing consent above, just as your care team's other clinical software does. AI output is assistive only and is not medical advice — for dosing or symptoms, always follow your care team; a clinician always reviews and approves anything AI helped draft before it reaches you.

3. Information Sharing and Disclosure

3.1 Healthcare Team

Your health information is shared with your designated healthcare providers (doctors and nurse practitioners) at your connected clinic to facilitate your OIT treatment. This sharing is essential for proper medical care. Clinics are isolated from one another: staff at one clinic cannot access another clinic's patients.

3.2 Caregivers

Parents/guardians may grant access to designated caregivers with either view-only or edit permissions. You control who has access to your child's information and can revoke that access at any time.

3.3 Service Providers

We use the third-party providers below to operate the Service. The table states plainly whether each one can receive health information.

Every provider that can receive Protected Health Information is covered by a HIPAA Business Associate Agreement. Providers without such an agreement are constrained by design so that health information cannot reach them — through closed data schemas, server-side enforcement, and generic notification content — rather than by promise alone. We do not authorize any provider to use your information for its own purposes.

3.4 Legal Requirements

We may disclose information when required by law, court order, or to protect the safety of individuals.

3.5 Business Transfers

If Alice Care is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. Any successor will remain bound by this Privacy Policy and by our HIPAA obligations, and we will notify you before your information becomes subject to a materially different policy.

3.6 Care-Management Programs and Billing

Your clinic may ask for your separate, explicit consent to enroll your child in a care-management program such as Principal Care Management (PCM), under which your care team documents the time it spends managing the treatment between visits and bills your insurer for that service.

• Enrollment requires your affirmative consent, recorded in the app. Only a parent or legal guardian can give it.
• Where a program applies, the records shared for billing are the standard ones a clinic discloses to a payer: diagnosis and service codes, dates, and documented care-management time.
• Only one practice at a time may bill this program for your child's condition.
• You may withdraw consent at any time in Settings → Privacy & Security. Withdrawing stops the billing; it does not affect your child's treatment or your access to the Service.

Billing and claims handling are performed by your clinic under its own Notice of Privacy Practices. Alice Care does not submit claims to insurers on your behalf and does not collect or store payment-card information.

4. Data Security

We implement comprehensive security measures to protect your information:

• Encryption: All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Access Controls: Role-based, per-patient, and per-clinic access rules enforced on our servers, so users see only the records their relationship to a patient allows
• Multi-Factor Authentication: Required for every doctor, nurse practitioner, and administrator before any health record can be opened. A browser or phone you explicitly choose to trust can stand in for the code for up to 12 hours.
• Session Management: For doctors, nurse practitioners, and administrators, automatic sign-out after 15 minutes of inactivity, and a 12-hour absolute limit on any session regardless of activity. Family accounts stay signed in for up to 30 days, after which you are asked to sign in again. Please sign out when using a shared device.
• Audit Logging: Access to and changes made to health information are written to an append-only audit log that cannot be edited or deleted, including by us
• Administrative Separation: The administrator role manages accounts and has no access to health information by design
• Regular Security Assessments: Ongoing vulnerability testing, independent security review, and automated tests that fail the build if health data could reach a vendor that should not receive it

No system is perfectly secure. If a breach affecting your unsecured Protected Health Information occurs, we will notify you and the U.S. Department of Health and Human Services as HIPAA's Breach Notification Rule requires.

5. Data Retention

We retain your information as follows:

• Health Records: Minimum of 6 years as required by HIPAA, or longer if required by state law or by your clinic's own retention obligations
• Account Information: Until you request account deletion
• Audit Logs: 6 years for compliance purposes
• De-identified Analytics: Removed when your account is deleted

Where you are treated by a connected clinic, that clinic is the custodian of your medical record and its retention obligations govern how long the record is kept, even if you close your Alice Care account.

6. Your Rights

You have the following rights regarding your information:

• Access: Request a copy of your health information
• Correction: Request corrections to inaccurate information
• Deletion: Request deletion of your account (subject to legal retention requirements)
• Restriction: Request restrictions on certain uses of your information
• Portability: Export your data from Settings → Export My Data
• Accounting: Request an accounting of disclosures of your PHI

You can exercise several of these directly in the app:

• Turn off usage analytics — Settings → Privacy & Security. Turning it off stops future events; previously sent de-identified events are removed when your account is deleted.
• Revoke AI consent — Settings → Privacy & Security → AI & Data Sharing
• Withdraw care-management consent — Settings → Privacy & Security
• Remove a caregiver's access — from your child's profile
• Export or delete your account — Settings

To exercise any right not available in the app, please contact us using the information in Section 9.

7. Children's Privacy

Alice Care is designed to help parents and caregivers manage treatment for children with food allergies. We do not knowingly collect information directly from children under the age of thirteen (13), and the Service is not intended for use by children to create their own accounts.

We collect information about children — including children under 13 — only with the verifiable consent of a parent or legal guardian, and only as necessary to provide the treatment management features the parent or guardian has requested.

Parents and legal guardians may, at any time:

• Review the personal information we have collected about their child
• Request that we correct or delete that information
• Refuse to permit further collection or use of their child's information by closing the account

The community feature is intended for parents, caregivers, and adult patients. Children under 13 should not post or comment in the community, and we do not knowingly permit them to do so.

To exercise any of the rights above, contact us using the information in Section 9.

8. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the new policy in the app and updating the "Last Updated" date. Where a change materially expands how we use or share your information, we will ask for your consent before it applies to you. Your continued use of the Service after changes constitutes acceptance of the updated policy.

9. Contact Us